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1 Application filed January 16, 2002. Appellants claim the benefit under 
35 U.S.C. § 1 19 of Japan application 2001-009,646 filed January 18, 2001. 
The real party in interest is Hitachi, Ltd. 
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STATEMENT OF THE CASE 
Appellants appeal from a final rejection of claims 23-44 under 

authority of 35 U.S.C. § 134(a). The Board of Patent Appeals and 

Interferences (BPAI) has jurisdiction under 35 U.S.C. § 6(b). 

We affirm the rejections. 

Appellants' invention relates to a public key cryptographic method for 

private communication with high security. In the words of Appellants: 

In order to achieve the above objects of the 
invention, a ciphertext is created by using a 
combination of a plaintext and random numbers in 
order to reject an illegal ciphertext input to a 
(simulated) deciphering oracle and to guarantee 
security against adaptive chosen ciphertext attacks. 
The environment given a deciphering oracle means 
an environment which unconditionally gives the 
deciphered results of any ciphertext excepting a 
target ciphertext. According to one of specific 
public-key cryptographic schemes, the following 
secret-key is created: 

• *l»ff2 > tti>yi2>Uti.Sfe2,2 € Zq 
and the following public key is created: 

• p, q ; prime number (q is a prime factor of>l ) 

• € Zp : ord p (si) = ord^) ~ q 

*c~Si* l m Xi mod;?, di ~^« i s2» 14 mod p t d^^gi^g^ 1 * modp, k-tfmadp, 

• k,kt, A3 : positive constant (lO* 1 *** < 9, 1Q* 3 < q, ifj*i+&+*5 < p ) 

(Spec. 5, 1. 15 to 6, 1. 5). 
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Claim 23 is exemplary: 

23. A public-key cryptographic method 
implemented in a computer system comprising: 

a key generation step of generating a secret- 
key: 

and a public-key: 

* G,G* : finite (multiplicative) group G Q G 1 

* $ : prime number (the order of G) 

* w : Xi x X$ x M — ► G* : one* to-one mapping 

* 7T- 1 : Im(ff) — ► Xi xX 2 xM 

where the group G is a partial group of the group 
G', Xi and X 2 are an infinite set of positive integers 
which satisfy: 

at j jog < q (Vai € Xi, Vay € X?) 

where M is a plaintext space; 

a ciphertext generation and transmission 
step of selecting random numbers a^Xl, a 28 X 2 , 
r g Zq for a plaintext m (m 8 M), calculating: 

where a = ai || a 2 , and, and transmitting (ui, u 2 , e, v) 
as a ciphertext; and 

a ciphertext reception and decipher step of 
calculating from the received ciphertext and by 
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using the secret key, a'i, a' 2 , m' (a'i 8 Xi, a'2 8 X 2 , m' g M) 
which satisfy: 

and if the following is satisfied: 

outputting m' as the deciphered results (where a' = 
a'i || a' 2 ), whereas if not satisfied, outputting as the 
decipher results the effect that the received 
ciphertext is rejected. 

The prior art relied upon by the Examiner in rejecting the claims on 
appeal is: 

Cramer US 6,697,488 Bl Feb. 24, 2004 

REJECTIONS 

The Examiner rejects the claims as follows: 

Rl : Claims 23, 28, 35 and 40 stand rejected under 35 U.S.C. § 1 12, 
second paragraph, for being indefinite, for failing to particularly point out 
and distinctly claim the subject matter which Appellants regard as their 
invention. 

R2: Claims 24, 40, and 41 stand rejected under 35 U.S.C. § 1 12, second 
paragraph, for being indefinite (as above). 

R3: Claim 30 stands rejected under 35 U.S.C. § 1 12, second paragraph, for 
being indefinite (as above). 

R4: Claim 36 stands rejected under 35 U.S.C. § 1 12, second paragraph, for 
being indefinite (as above). 
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R5: Claims 28, 40, and 41 stand rejected under 35 U.S.C. § 1 12, second 
paragraph, for being indefinite (as above). 

R6: Claims 23-44 stand rejected under 35 U.S.C. § 103(a) for being 
obvious over Cramer. 

Groups of Claims: 

The claims will be addressed in the order of the rejections, grouped in 
accordance with the arguments. 

Appellants contend that the claims are definite and that the claimed 
subject matter is not rendered obvious by Cramer. The Examiner contends 
that each of the three groups of claims is properly rejected. 

Only those arguments actually made by Appellants have been 
considered in this opinion. Arguments that Appellants could have made but 
chose not to make in the Briefs have not been considered and are deemed to 
be waived. 

ISSUE 

The issue with regard to the rejection under 35 U.S.C. § 1 12 is 
whether Appellants have shown that the Examiner erred in rejecting the 
claims for being expressed in an indefinite manner. The issue with regard to 
the rejection under 35 U.S.C. § 103 is whether Appellants have shown that 
the Examiner erred in concluding the claims to be obvious over Cramer. 
The second issue turns on whether the specific elements in Appellants' 
equations describing the nature of their public and private key, and in the 
equations describing the ciphertext generation are obvious over the 
somewhat different equations taught in the Cramer reference. 
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FINDINGS OF FACT 

The record supports the following findings of fact (FF) by a 

preponderance of the evidence. 

1 . Appellants have invented an improved public key cryptographic method 
for generating the ciphertext of a plaintext message (Spec 5, 1. 8). The 
method is resistant to attacks using the adaptive chosen ciphertext code 
breaking technique as it rejects illegal ciphertexts (Spec. 5, 1. 20). The 
method develops a seven element secret-key described as: 

> xi, x 2 , yn, yi2, yiuYn, z included in the set Z q 

The method also develops a public key involving the variables g h g 2 , c, 
d, and h and satisfying a number of conditions including a di=gi yll g 2 y12 , 
andad 2 = gl y V 22 

2. The Cramer reference is addressed to a public key crypto system that 
generates pubic and private keys for encrypting messages (Col. 4, 1. 19). 
The Cramer teachings provide a public key crypto system that is secure 
against an adaptive chosen ciphertext attack by rejecting illegitimate 
ciphertexts (Col. 9, 1. 17; col. 4, 1. 12). The method teaches choosing a 
private key described as : 

> xi, x 2 , yi, y 2 , z included in the set Z q 

The Cramer method also develops a public key using formulas to develop 
the values gi, g 2 , c, d, and h. 

3. The field of formulating the mathematics for the generation of 
cryptosystems is a highly advanced field of extreme complexity and 
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competitive challenges for both protecting data and for breaking the 
protection (Spec. 1 - 3; Cramer col. 1, 11. 19 to col. 2, 11.35). 

PRINCIPLES OF LAW 

Appellants have the burden on appeal to the Board to demonstrate 
error in the Examiner's position. See In re Kahn, 441 F.3d 977, 985-86 
(Fed. Cir. 2006) ("On appeal to the Board, an applicant can overcome a 
rejection [under § 103] by showing insufficient evidence of prima facie 
obviousness or by rebutting the prima facie case with evidence of secondary 
indicia of nonobviousness.") (quoting In re Rouffet, 149 F.3d 1350, 1355 
(Fed. Cir. 1998)). 

"Indefmiteness under 35 U.S.C. § 1 12 2 is an issue of claim 
construction and a question of law that we review de novo." Cordis Corp. v. 
Boston Scientific Corp., 561 F.3d 1319, 1331 (Fed. Cir. 2009) (citing 
Praxair, Inc. v. ATMI, Inc., 543 F.3d 1306, 1319 (Fed. Cir. 2008)). 

Appellant may sustain its burden by showing that where the Examiner 
relies on a combination of disclosures, the Examiner failed to provide 
sufficient evidence to show that one having ordinary skill in the art would 
have done what Appellant did. United States v. Adams, 383 U.S. 39 (1966); 
In re Kahn, 441 F.3d 977, 987-988 (Fed. Cir. 2006); DyStar Textilfarben 
GmbH & Co. Deutschland KG v. C.H. Patrick, Co., 464 F.3d 1356, 1360- 
1361 (Fed. Cir. 2006). The mere fact that all the claimed elements or steps 
appear in the prior art is not per se sufficient to establish that it would have 
been obvious to combine those elements. United States v. Adams, supra; 
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Smith Industries Medical systems, Inc. v. Vital Signs, Inc., 183 F.3d 1347, 
1356 (Fed. Cir. 1999). 

"[T]he words of a claim 'are generally given their ordinary and 
customary meaning."' Phillips v. AWH Corp., 415 F.3d 1303, 1312 (Fed. 
Cir. 2005) (en banc) (internal citations omitted). "[T]he ordinary and 
customary meaning of a claim term is the meaning that the term would have 
to a person of ordinary skill in the art in question at the time of the invention, 
i.e., as of the effective filing date of the patent application." Id. at 1313. 

ANALYSIS 

From our review of the administrative record, we find that the 
Examiner has explained the rejections of Appellants' claims under 
35 U.S.C. §§ 1 12 and 103 on pages 4 to 23 of the Examiner's Answer. In 
opposition, Appellants present a number of arguments. 

Arguments with respect to the rejection 
of claims 23, 28, 35 and 40 [Rl ] 
claims 24, 40 and 41 [R2] 
claim 30 [R3] 
claim 36[R4] and 
claims 28, 40 and 41 [R5] 
under 35 U.S.C. § 112 paragraph 2 

The Examiner has rejected each of the noted claims for being 
indefinite, in the sense that the recited values (e.g., sl u sl 2 , q, G, gi, g 2 etc.) 
are expressed in the claims as mere variables, letters and numbers, with no 
definition of "how those elements are generated or obtained and/or what 
they are intended to be, thus the metes and bounds of the claims are not 
definite." (Ans. 24, middle). 
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Appellants have responded in the Brief with a mere assertion that the 
claims are definite (App. Br. 16, middle). In the Reply, Appellants state that 
an antecedent basis is provided for the terms in the sense that the same term 
is referred to as "the ciphertext" when "ciphertext" has been referred to 
previously in the claims (Reply Br., 4-9). Appellants' response does not 
address the point made by the Examiner. 

This is an art of very high complexity (FF #3), and the practitioner in 
such an art is assumed to have advanced math skills. But the attachment of 
meaning to the variables expressed in the equations of the claims, either 
through definitions in the specification or in the claims themselves, adds 
necessary clarity to the claims to be able to properly appreciate the metes 
and bounds of the protected invention. Appellants have not done this. The 
Examiner's contrast of the instant claims to those in the prior art was 
insightful (Ans. 25, top). We find that Appellants' bare assertion of 
compliance with 35 U.S.C. § 1 12, paragraph 2, and discussion of 
antecedents of expressions in the formulae did not persuasively counter the 
Examiner's rejection. 

We thus find that Appellants have not established error in the 
rejections [Rl] to [R5] of the noted claims under 35 U.S.C. § 1 12, 
paragraph 2. 

Arguments with respect to the rejection 
of claims 23 to 44 
under 35 U.S.C. § 103(a) [R6] 

The Examiner has rejected claims 23-44 for being obvious over 
Cramer. Cramer presents a system and method for encrypting plaintext to 
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ciphertext and decrypting back to the plaintext using the same five stages 
expressed in the claims (Col. 6, 11. 40-65; FF #1, FF#2). Appellants point 
out certain differences in the formulas used by the reference, and how they 
are different from the formulas of the claims (App. Br. 17-22, further 
expanded for each claim in App. Br. 22-55). 

Appellants present the same set of arguments against the rejection in 
the discussion of each of the claims, with minor variations based on the 
presence or absence of a certain claim limitation. We will thus address the 
main arguments directly and consider the variations as they arise. 

Appellants first argue that certain claims are different from the 
Cramer reference for their exclusion of the hash function in the formulas 
(App. Br. 18, top). Appellants point to the use of the hash function H in 
Cramer's encryption step (Col. 8, 1. 10): 

u l =g{,u- 1 =g 2 r , e =h r m, a =H(u h u 2 , e) , v = (f ef a . 

Appellants explain that various cryptographic schemes are based on 
various assumptions and that some are not always realistic. "The collision 
intractability of the hash function has not yet been verified (see pages 3, line 
27 to page 4, line 24 of the present application)." (App. Br. 18, middle). 
Thus, Appellants do not rely on the hash function for the encryption step 
recited in independent claims 23, 24, 28, 30, 40, and 41. In contrast, we note 
that in the ciphertext generation step of claim 35, Appellants choose to use 
the hash function: 

u\ = g\ mod p, t*2 ~ 22 r mod p, v ~ gi ai e r d ar mod p, K ^ E(h r mod p) 

where 
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• : hash function 

The Examiner points out that "Cramer teaches that the use of a hash 
function can be omitted (col. 9, lines 60-67)." (Ans. 25, bottom). The 
discussion in Cramer is in the context of increasing or decreasing the amount 
of calculation that must be performed to encode the ciphertext and recover 
the plaintext as a tradeoff against the degree of protection that one desires 
(id.). Mere "lunch-time" attacks, by a casual intruder, can be thwarted by a 
lesser degree of protection, but serious "adaptive chosen ciphertext attacks" 
require a higher degree of protection and, the user may be willing to invest 
the time and effort to perform the increased computations that this higher 
level requires. (Cramer, col. 2, 1. 48). While the mathematics are highly 
complex in this technical field, we do find that the stated balance of 
computational difficulty versus higher security is a theme running through 
both Appellants' disclosure and the Cramer reference. The Examiner 
indicates that the choice of the presence or absence of the hash function in 
the equation ciphertext generation would be an obvious variant in view of 
the teachings of Cramer. We do not find the Appellants to have 
demonstrated error in that conclusion. 

Appellants next argue that "In Cramer, the public key includes one 
element 'd' as shown in Fig. 2 and as discussed at column 7, lines 26 to 39 
thereof. The element 'd' as per Cramer relates to the two elements yi and y 2 
of the private key." (App. Br. 19, bottom). 

Thus in Cramer the public key is defined (partially) as follows: 

Next, a first group-number c, a second group- 
number h, and a third group-number d are derived 
in a generation step 15 from the chosen numbers 



11 



Appeal 2009-001507 
Application 10/046,224 

gi, g 2 , xi, x 2 , yi, y2, z by using calculating means 
according to the following formulas: 

The public key is now complete and is 
represented by the numbers gi, g 2 , c, d, and h. 

(Col. 7, 11. 19-17). 

Cramer thus teaches one variable d, relating to yi and y 2 (App. Br. 19, 
bottom). Appellants distinguish their claims 23, 24, 28 and 30 which 
contain two variables d! and d 2 . 
• c~ gi Xl 92 X7 mod p, di - g\ Vu gz m mod p, d 2 = gi Wl 92 m7 mod p, h « gr mod p, 

In explaining the advantages of the single variable, d, Appellants 
contend, "To improve the efficiency of the encryption system, i.e. to reduce 
the calculation amount of v, it is preferable that the number of d (the value 
of k) is small." (App. Br. 21, bottom). 

In establishing their point, Appellants quote from a treatise by the 
authors of the Cramer reference. That line of reasoning is as follows: 

At first, (ui, u 2 , e) is replaced with (an a*), where 0<a< q. 

Further, di={ gif~ m { gzf 3 ® mod p, where 0<i<k is calculated and 
made open. 

In the above-mentioned encryption, the calculation of v is replaced 

with: 
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We find, in this equation, that the number of d factors is a 
discretionary number, depending on the amount of security that the user 
requires and the amount of computation that the application can withstand. 

The Examiner contends that Cramer's patent also suggests a varying 
number of d variables, depending on the amount of security that the user 
desires. "Examiner respectfully submits that Cramer teaches "d" (Cramer, 
section V, column 9 [line 58] ), thus 'di' can change and varies." (Ans. 26, 
top). 

With regard to claim 23, Appellants contend that 

The secret key includes x h x 2 , yn, yi 2 , yn, yn, and 
z. The public key includes elements dj and d 2 . The 
element di relates to the elements yn and 
yi2 of the secret key, and the element d 2 relates to 
the elements y 2 i and y 22 of the secret key. Cramer 
does not disclose this feature. 
(App. Br. 22, bottom) 

In summary with respect to this point, the reference Cramer teaches or 
suggests that the number of "d" variables may be varied in choosing the 
elements for the private key, with the computations and security changing in 
a known way depending on the chosen complexity of the key (Cramer, col. 
9, 1. 58). The Examiner has considered the choice to be obvious to one of 
ordinary skill in this art, and we do not find that conclusion in error. 

In Cramer, the secret key, called the private key, is derived and 
chosen as follows: 



13 



Appeal 2009-001507 
Application 10/046,224 

In the private-key choosing step 13 from a set of elements 
modulo q, denoted as Z q and indicated by reference number 
14, for the private key a first exponent -number x 15 a second 
exponent-number x 2 , a third exponent-number z, a fourth 
exponent-number y 1; and a fifth exponent-number y 2 are 
chosen at random. This can be expressed as follows. 

Xi,x 2 ,y 1; y 2 ,zeZ g 
(Cramer, col. 7, 11. 15-24). 

Appellants argue that their invention, as recited in claims 23, 24, 28 
and 30, uses four elements of y in the private key, namely: 

• ^1,^2,1/11,2/12,2/21,2/22,* e 

(App. Br. 20, middle). 

Appellants argue that this difference may appear small, but that it has 
a large effect {id.). The Examiner contends that the differences are within 
the knowledge of the prior art, as evidenced by Cramer's statements that the 
d, yi, j2 and hash function are typically added to enhance the security of an 
encryption from the above lunch-time attacks to guard against more 
determined assaults (Cramer, col. 9, 11. 65-68). 

We have considered Appellants' arguments and do not find them 
compelling of error. The presence of two or four or a variable number of 
"y" values in this complicated art is suggested by the reference's discussion 
of the balance of complication of computation versus security of the 
message, noted above. 

Appellants have argued differences from the reference in the 
calculation of the ciphertext generation and transmission steps (App. Br. 25, 
top) and the formula for rejecting an improper ciphertext (App. Br. 26, 
middle). We agree with the Examiner that these expressions have not been 
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demonstrated to be more than obvious changes to the prior art (Ans. 26, 27). 
Cramer uses very similar formulae for the encryption, validation, and 
decryption (Cols. 7 - 9), and we find the differences of the claims from the 
prior art to be within the scope of the considerable abilities of a skilled 
person in this art. 

As the basic argument of simplicity of calculation versus strength of 
encryption is repeated with local computational variation in the arguments 
for each claim, we extend our findings to cover all the claims of the 
rejection. 

CONCLUSIONS OF LAW 

Based on the findings of facts and analysis above, we conclude that 

the Examiner did not err in rejecting claims 23, 24, 28, 35, 36, 40, and 41 
under 35 U.S.C. § 1 12, paragraph two, and did not err in rejecting claims 23- 
44under35U.S.C. § 103(a). 

DECISION 

Rl : The Examiner's rejection of claims 23, 28, 35, and 40 under 35 U.S.C. 
§ 1 12, second paragraph, for being indefinite is affirmed. 
R2: The Examiner's rejection of claims 24, 40, 41 under 35 U.S.C. § 1 12, 
second paragraph, for being indefinite is affirmed. 

R3: The Examiner's rejection of claims 30 under 35 U.S.C. § 1 12, second 
paragraph, for being indefinite is affirmed. 

R4: The Examiner's rejection of claims 36 under 35 U.S.C. § 1 12, second 
paragraph, for being indefinite is affirmed. 
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R5: The Examiner's rejection of claims 28, 40, and 41 under 35 U.S.C. § 
112, second paragraph, for being indefinite is affirmed. 
R6: The Examiner's rejection of claims 23-44 under 35 U.S.C. § 103(a) 
for being obvious over Cramer is affirmed. 

No time period for taking any subsequent action in connection with 
this appeal may be extended under 37 C.F.R. § 1.136(a)(l)(iv). 



AFFIRMED 
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